Patch Forecast
Amber warning
Patch this week. CISA deadline for US federal agencies: 3 Nov 2026.

CVE-2026-110936 Exploited in the wild

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Risk score
73/100
CVSS
6.7 v3.1
Exploit chance (30 days)
0.2%
Published
15 Oct 2026
Added to CISA's exploited list
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A vulnerability in Siemens Software Center (all versions < V4.0.9.8) allows an authenticated local attacker to place a specially crafted DLL, leading to arbitrary code execution with the affected application's privileges.
Affected
{'product': 'Software Center', 'vendor': 'Siemens', 'versions': 'all versions < V4.0.9.8'}
Fix
Apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable
Exploitation
Exploited in the wild

Story map

Story map: Siemens Software CenterTHE FLAWSTHE FIXCVE-2026-110936Siemens Software CenterUncontrolled Search PathElement VulnerabilityCVSS 6.7 · EPSS 0% · exploitedFixApply mitigations in accordancewith vendor instructions, ordiscontinue use of the productif mitigations are unavailableWho is exposed{'product': 'Software Center','vendor': 'Siemens', 'versions':'all versions < V4.0.9.8'}AMBER · PATCH THIS WEEKSiemensSoftware CenterA vulnerability in SiemensSoftware Center (all versions <V4.0.9.8) allows anauthenticated local attacker toplace a specially crafted DLL,leading to arbitrary codeexecution with the affected…Where it standsExploited in the wildOn CISA's exploited list since 20 OctUS federal deadline 3 Nov2 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.20 Oct · CISAAdded to the Known Exploited Vulnerabilities list20 Oct · Infosecurity MagazineSiemens Customers Targeted by ClickFix AttackersExploiting DLL Side-Loading Flaw20 Oct · CISA advisories (US)CISA Adds Six Known Exploited Vulnerabilities toCatalog22 Oct · CISA advisories (US)Siemens Software Center25 Oct · Help Net SecurityWeek in review: PHP vulnerabilities patched,exploited Palo Alto GlobalProtect VPN flaw3 Nov · Deadline · to comeUS federal agencies must have patched by thenCONNECTS TOSame weaknessCWE-427 (CWE-427)18 other warnings in 30 days →Reported alongsideIn the RingRTC library before2.72.0 for Signal, a peer that…CVE-2026-113380 · in 1 of the samearticle →Reported alongsidePHP has various global state thattemporarily points into request…CVE-2026-109619 · in 1 of the samearticle →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Siemens Software Center: Amber, patch this week. A vulnerability in Siemens Software Center (all versions < V4.0.9.8) allows an authenticated local attacker to place a specially crafted DLL, leading to arbitrary code execution with the affected application's privileges.

The flaws

  • CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVSS 6.7 · EPSS 0% · exploited)

The fix

Fix: Apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable

Who is exposed: {'product': 'Software Center', 'vendor': 'Siemens', 'versions': 'all versions < V4.0.9.8'}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 20 Oct
  • US federal deadline 3 Nov
  • 2 outlets covering it

How it unfolded

  1. 20 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 20 Oct, Infosecurity Magazine (press): Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
  3. 20 Oct, CISA advisories (US) (official): CISA Adds Six Known Exploited Vulnerabilities to Catalog
  4. 22 Oct, CISA advisories (US) (official): Siemens Software Center
  5. 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
  6. 3 Nov, Deadline (official): US federal agencies must have patched by then

Connects to

In the news

TL;DR

Siemens Software Center has a DLL side-loading vulnerability (CVE-2026-110936) that allows attackers to execute code with application privileges, exploited in the wild.

  • Siemens Software Center customers are being targeted by attackers using the ClickFix technique.
  • The vulnerability allows attackers to load malicious DLL files into a directory searched by the application.
  • Siemens has urged customers to update to version 4.0.9.8, which contains a fix for the issue.
  • The vulnerability has a CVSS score of 8.4 and is considered high-risk.

AI summary of 2 articles.

Why it is Amber

  • CVSS 6.7 medium
  • Exploited in the wild (CISA KEV)
  • Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

References

Original description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Last activity 22 Oct 2026. Patch Forecast updates every hour.